CISA-2025-48574 — Vulnetix

CISA-2025-48574 PUBLISHED CVSS 8.4 HIGH

Reported by google_android · Published March 2, 2026

In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS 3.1

8.4

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Google	Android	16, 15, 14
Google	Android	14, 16, 16

Timeline

Mar 2, 2026 CVE Published
Mar 6, 2026 CVE Updated

References

vendor-advisory

Open in Interactive Console →